Session sharing in asp .net

[cheelam_mze]

Hye,

This is my scenario:
1. Admin login to web application and access module M.
2. Admin logout from the application. User B sees the URL of module
M.
3. User B login to the application. User B does not have access to
module M.
4. User B types the URL of module M and able to access the module M.

This is my problem:
Why user B can access module M by just typing the URL since he has no
authorisation to module M? Could it be because of the session is
still refering to Admin session although Admin has already logged out?

thanks

 

[Guest]

It's because of the way role authorization has been implemented in the
application. If you are using ASP.NET 2.0, check this out
http://weblogs.asp.net/scottgu/page...ng-Windows-Authentication-and-SQL-Server.aspx